@qodalis/cli-server-node 1.0.0-beta.4 → 1.0.0-beta.6

package/dist/src/auth/cli-server-auth-gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-server-auth-gate.js","sourceRoot":"","sources":["../../../src/auth/cli-server-auth-gate.ts"],"names":[],"mappings":";;AAkBA,sCAGC;AAyBD,oDAsBC;AAGD,8DAiBC;AAOD,oDAqDC;AAjJD,uDAAoG;AACpG,4CAA+C;AAE/C,MAAM,MAAM,GAAG,IAAA,qBAAY,EAAC,YAAY,CAAC,CAAC;AAW1C,mGAAmG;AACnG,SAAgB,aAAa,CAAC,IAAY;IACtC,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACzE,OAAO,CAAC,IAAI,GAAG,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC;IACvB,oBAAoB;IACpB,mBAAmB;IACnB,wBAAwB;IACxB,mBAAmB;IACnB,sBAAsB;IACtB,2BAA2B;IAC3B,SAAS;IACT,UAAU;IACV,aAAa;CAChB,CAAC,CAAC;AAEH,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;AAU3D,yEAAyE;AACzE,SAAgB,oBAAoB,CAChC,QAA6B,EAC7B,OAAgB,EAChB,KAAc;IAEd,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IAC3C,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAChG,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,MAAM,GAAG,GAAa,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC,CAAC;IAC5D,IAAI,OAAO,GAAyB,IAAI,CAAC;IACzC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACvB,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;YACtB,IAAI,OAAO,GAAG,KAAK,QAAQ;gBAAE,MAAM;YACnC,MAAM,KAAK,GAAqC,OAAO,CAAC,UAAU,EAAE,IAAI,CACpE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,WAAW,EAAE,CACvD,CAAC;YACF,IAAI,CAAC,KAAK;gBAAE,MAAM;YAClB,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC,CAAC;YAC/C,OAAO,GAAG,KAAK,CAAC;QACpB,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACf,CAAC;AAED,2DAA2D;AAC3D,SAAgB,yBAAyB,CAAC,MAAc,EAAE,IAAY,EAAE,IAAS,EAAE,OAA8B;IAC7G,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QACvC,IAAI,IAAI,KAAK,GAAG,MAAM,UAAU,IAAI,IAAI,KAAK,GAAG,MAAM,iBAAiB,EAAE,CAAC;YACtE,OAAO,CAAC,sCAAC,CAAC,eAAe,EAAE,GAAG,oBAAoB,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;QAC9G,CAAC;IACL,CAAC;IACD,IAAI,IAAI,KAAK,cAAc,IAAI,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;QAC9D,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QAC9C,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,sCAAC,CAAC,SAAS,CAAC,CAAC,CAAC,sCAAC,CAAC,UAAU,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,IAAI,KAAK,yBAAyB,IAAI,IAAI,CAAC,UAAU,CAAC,0BAA0B,CAAC,EAAE,CAAC;QACpF,OAAO,CAAC,sCAAC,CAAC,SAAS,CAAC,CAAC;IACzB,CAAC;IACD,IAAI,IAAI,KAAK,mBAAmB,IAAI,IAAI,CAAC,UAAU,CAAC,oBAAoB,CAAC,EAAE,CAAC;QACxE,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,sCAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,sCAAC,CAAC,UAAU,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,EAAE,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,SAAgB,oBAAoB,CAChC,OAAyC,EACzC,OAA8B;IAE9B,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACvD,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;QACvB,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YAC/B,IAAI,EAAE,CAAC;YACP,OAAO;QACX,CAAC;QACD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QACxC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACvB,IAAI,EAAE,CAAC;YACP,OAAO;QACX,CAAC;QACD,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YAC/C,IAAI,EAAE,CAAC;YACP,OAAO;QACX,CAAC;QACD,IAAI,CAAC,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAClE,IAAI,EAAE,CAAC;YACP,OAAO;QACX,CAAC;QACD,IAAI,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;YAClF,IAAI,EAAE,CAAC;YACP,OAAO;QACX,CAAC;QAED,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,IAAI,CAC9B,CAAC,GAAG,EAAE,EAAE;YACJ,MAAM,OAAO,GAAG,yBAAyB,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,MAAM,CAC7E,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC,CAAC,CACrC,CAAC;YACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;gBACvF,OAAO;YACX,CAAC;YACD,GAAG,CAAC,cAAc,GAAG,GAAG,CAAC;YACzB,IAAI,EAAE,CAAC;QACX,CAAC,EACD,CAAC,GAA0C,EAAE,EAAE;YAC3C,IAAI,OAAO,GAAG,EAAE,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAClC,qEAAqE;gBACrE,MAAM,CAAC,KAAK,CAAC,qCAAqC,EAAE,GAAG,CAAC,CAAC;gBACzD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;gBACzD,OAAO;YACX,CAAC;YACD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;YAC1B,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,IAAI,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,IAAI,WAAW,EAAE,CAAC,CAAC;QACpH,CAAC,CACJ,CAAC;IACN,CAAC,CAAC;AACN,CAAC"}

package/dist/src/auth/cli-server-auth.d.ts

@@ -0,0 +1,147 @@
+import type { IncomingMessage } from 'http';
+import type { Request } from 'express';
+/** Identity of an authenticated caller (HTTP request or WebSocket). */
+export interface CliServerAuthContext {
+    userId: string;
+    userName: string;
+    /** Absent for host-authenticated (adapter) callers. */
+    sessionId?: string;
+    /** Effective permissions (`resource:action`, `*` wildcards). */
+    permissions: string[];
+}
+/** Error thrown by {@link ICliServerAuth.authenticateRequest}; rendered as `{ error }`. */
+export interface CliServerAuthError extends Error {
+    status?: number;
+}
+/**
+ * Authentication provider that protects the whole CLI server (routes and
+ * sockets). Implemented by the users plugin (`usersPlugin.serverAuth`).
+ */
+export interface ICliServerAuth {
+    /** When false the server stays open; sockets only use tickets for optional identity. */
+    readonly protectServer: boolean;
+    /** True for routes the provider authenticates itself (its own API, its login). */
+    handlesPath(path: string, method: string): boolean;
+    /**
+     * Authenticates an HTTP request. Throws an error with `status`
+     * (401 unauthenticated, 403 e.g. password change required / CSRF); any
+     * other error is logged and answered with a generic 500.
+     */
+    authenticateRequest(req: Request): Promise<CliServerAuthContext>;
+    /**
+     * Consumes a single-use WebSocket ticket; undefined when invalid/expired/used.
+     * May throw an error with `status: 403` when the identity is valid but not
+     * allowed yet (e.g. password change required).
+     */
+    consumeTicket(ticket: string): Promise<CliServerAuthContext | undefined>;
+    hasPermission(ctx: CliServerAuthContext, permission: string): boolean;
+    /** Called once when installed into a server. */
+    attachToServer?(server: {
+        allowedOrigins?: string[];
+        broadcast: (message: Record<string, unknown>) => void;
+    }): void;
+    /**
+     * Re-validates a socket identity without sliding the session: the session still
+     * exists and is not expired, the user exists and is enabled. Returns the identity
+     * with fresh permissions, or undefined when it ended. Used to bind long-lived
+     * sockets (the shell) to their session. `request` is the socket's original
+     * upgrade request, for identities without a stored session that the provider
+     * re-authenticates from the request (e.g. a host auth adapter reading cookies).
+     */
+    revalidate?(ctx: CliServerAuthContext, request?: IncomingMessage): Promise<CliServerAuthContext | undefined>;
+    /** Records activity on the session behind `ctx` (slides the idle expiry). */
+    touch?(ctx: CliServerAuthContext): Promise<void>;
+    /** Writes an audit entry (never include secrets, command text or stdin). */
+    audit?(entry: CliServerAuditEntry): Promise<void>;
+    /** Subscribes to session lifecycle events; returns an unsubscribe function. */
+    onSessionEvent?(listener: (event: CliServerSessionEvent) => void): () => void;
+}
+/** Audit entry written by the server through {@link ICliServerAuth.audit}. */
+export interface CliServerAuditEntry {
+    event: string;
+    userId: string;
+    userName: string;
+    /** Acting user (defaults to the user). */
+    actorId?: string;
+    actorName?: string;
+    details?: string;
+    metadata?: Record<string, unknown>;
+}
+/**
+ * Session lifecycle events emitted by the auth provider:
+ * - `session-ended`: logout, expiry, revoke (kick), user disabled/deleted;
+ *   `revoked` is true for revocations, which also broadcast `session-kicked`;
+ * - `access-changed`: users/groups/permissions changed, or the expired-session
+ *   sweep ran (re-check open sockets).
+ */
+export type CliServerSessionEvent = {
+    type: 'session-ended';
+    sessionId: string;
+    userId?: string;
+    reason?: string;
+    revoked?: boolean;
+} | {
+    type: 'access-changed';
+    userId?: string;
+};
+/** Server permissions enforced when the users plugin protects the server. */
+export declare const CliServerPermissions: {
+    readonly CommandsExecute: "commands:execute";
+    readonly FilesRead: "files:read";
+    readonly FilesWrite: "files:write";
+    readonly DataQuery: "data:query";
+    readonly JobsRead: "jobs:read";
+    readonly JobsManage: "jobs:manage";
+    readonly LogsRead: "logs:read";
+    readonly ShellExecute: "shell:execute";
+    readonly AdminAccess: "admin:access";
+};
+/**
+ * Exact origin match. An entry ending in `:*` matches any port of that
+ * scheme+host (e.g. `http://127.0.0.1:*`).
+ */
+export declare function isOriginAllowed(origin: string | undefined, allowed: readonly string[] | undefined): boolean;
+/**
+ * Number of trusted reverse-proxy hops for a `trustProxy` setting:
+ * `false`/`0`/absent → 0 (untrusted), `true` → 1, a number n → n (values
+ * below 1 other than 0 count as 1).
+ */
+export declare function trustedProxyHops(trustProxy: boolean | number | undefined): number;
+/**
+ * The client address: the socket address, or with `trustProxy` (a hop count,
+ * `true` = 1) the `X-Forwarded-For` entry at index `len - hops`.
+ */
+export declare function clientAddress(req: {
+    headers: Record<string, string | string[] | undefined>;
+    socket?: {
+        remoteAddress?: string;
+    } | null;
+}, trustProxy: boolean | number | undefined): string;
+/** Minimal request shape for {@link isSameOrigin} (Node `IncomingMessage` or Express `Request`). */
+export interface OriginCheckRequest {
+    headers: Record<string, string | string[] | undefined>;
+    socket?: {
+        encrypted?: boolean;
+        remoteAddress?: string;
+    } | null;
+    /** Express app (when present, its `trust proxy` setting is honoured). */
+    app?: {
+        get?: (name: string) => unknown;
+    };
+}
+/**
+ * The request's own origin (`scheme://host:port`, normalized): the scheme from
+ * the socket (TLS or not) and the `Host` header. Behind a trusted proxy
+ * (`trustProxy`, or the Express app's `trust proxy` setting when omitted)
+ * `X-Forwarded-Proto` / `X-Forwarded-Host` win, read like `X-Forwarded-For`:
+ * the entry at index `len - hops` (the rightmost with one hop; the leftmost
+ * when the list is shorter; an empty entry is ignored).
+ */
+export declare function requestOrigin(req: OriginCheckRequest, trustProxy?: boolean | number): string | undefined;
+/**
+ * True when `origin` is the request's own origin (e.g. the bundled admin
+ * dashboard served by this server). Same-origin requests are not cross-site
+ * and always pass Origin/CSRF checks. Case-insensitive; default ports normalized.
+ */
+export declare function isSameOrigin(origin: string | undefined, req: OriginCheckRequest, trustProxy?: boolean | number): boolean;
+//# sourceMappingURL=cli-server-auth.d.ts.map

package/dist/src/auth/cli-server-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-server-auth.d.ts","sourceRoot":"","sources":["../../../src/auth/cli-server-auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,MAAM,CAAC;AAC5C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAEvC,uEAAuE;AACvE,MAAM,WAAW,oBAAoB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,uDAAuD;IACvD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gEAAgE;IAChE,WAAW,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,2FAA2F;AAC3F,MAAM,WAAW,kBAAmB,SAAQ,KAAK;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC3B,wFAAwF;IACxF,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,kFAAkF;IAClF,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;IACnD;;;;OAIG;IACH,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACjE;;;;OAIG;IACH,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAAC;IACzE,aAAa,CAAC,GAAG,EAAE,oBAAoB,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC;IACtE,gDAAgD;IAChD,cAAc,CAAC,CAAC,MAAM,EAAE;QACpB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;QAC1B,SAAS,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;KACzD,GAAG,IAAI,CAAC;IACT;;;;;;;OAOG;IACH,UAAU,CAAC,CAAC,GAAG,EAAE,oBAAoB,EAAE,OAAO,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAAC;IAC7G,6EAA6E;IAC7E,KAAK,CAAC,CAAC,GAAG,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjD,4EAA4E;IAC5E,KAAK,CAAC,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClD,+EAA+E;IAC/E,cAAc,CAAC,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,qBAAqB,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;CACjF;AAED,8EAA8E;AAC9E,MAAM,WAAW,mBAAmB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,0CAA0C;IAC1C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACtC;AAED;;;;;;GAMG;AACH,MAAM,MAAM,qBAAqB,GAC3B;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GACjG;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAElD,6EAA6E;AAC7E,eAAO,MAAM,oBAAoB;;;;;;;;;;CAUvB,CAAC;AAEX;;;GAGG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GAAG,OAAO,CAW3G;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,GAAG,MAAM,CAMjF;AAeD;;;GAGG;AACH,wBAAgB,aAAa,CACzB,GAAG,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IAAC,MAAM,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAA;CAAE,EAC3G,UAAU,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,GACzC,MAAM,CAER;AAED,oGAAoG;AACpG,MAAM,WAAW,kBAAkB;IAC/B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IACvD,MAAM,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAChE,yEAAyE;IACzE,GAAG,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAA;KAAE,CAAC;CAC7C;AAsCD;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,kBAAkB,EAAE,UAAU,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,SAAS,CAKxG;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,EAAE,kBAAkB,EAAE,UAAU,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,OAAO,CAWxH"}

package/dist/src/auth/cli-server-auth.js

@@ -0,0 +1,143 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CliServerPermissions = void 0;
+exports.isOriginAllowed = isOriginAllowed;
+exports.trustedProxyHops = trustedProxyHops;
+exports.clientAddress = clientAddress;
+exports.requestOrigin = requestOrigin;
+exports.isSameOrigin = isSameOrigin;
+/** Server permissions enforced when the users plugin protects the server. */
+exports.CliServerPermissions = {
+    CommandsExecute: 'commands:execute',
+    FilesRead: 'files:read',
+    FilesWrite: 'files:write',
+    DataQuery: 'data:query',
+    JobsRead: 'jobs:read',
+    JobsManage: 'jobs:manage',
+    LogsRead: 'logs:read',
+    ShellExecute: 'shell:execute',
+    AdminAccess: 'admin:access',
+};
+/**
+ * Exact origin match. An entry ending in `:*` matches any port of that
+ * scheme+host (e.g. `http://127.0.0.1:*`).
+ */
+function isOriginAllowed(origin, allowed) {
+    if (!origin || !allowed || allowed.length === 0)
+        return false;
+    const o = origin.toLowerCase().replace(/\/+$/, '');
+    return allowed.some((entry) => {
+        const e = entry.toLowerCase().replace(/\/+$/, '');
+        if (e.endsWith(':*')) {
+            const base = e.slice(0, -2);
+            return o === base || (o.startsWith(base + ':') && /^\d+$/.test(o.slice(base.length + 1)));
+        }
+        return o === e;
+    });
+}
+/**
+ * Number of trusted reverse-proxy hops for a `trustProxy` setting:
+ * `false`/`0`/absent → 0 (untrusted), `true` → 1, a number n → n (values
+ * below 1 other than 0 count as 1).
+ */
+function trustedProxyHops(trustProxy) {
+    if (typeof trustProxy === 'number') {
+        if (trustProxy === 0)
+            return 0;
+        return trustProxy >= 1 ? Math.floor(trustProxy) : 1;
+    }
+    return trustProxy ? 1 : 0;
+}
+/**
+ * The `X-Forwarded-*` entry behind `hops` trusted proxies (for
+ * `X-Forwarded-For`: the client): index `len - hops` (with one hop, the
+ * rightmost entry, appended by the trusted proxy; leftmost entries are
+ * client-controlled). The leftmost entry when the list is shorter than `hops`;
+ * undefined when the header is absent or the selected entry is empty.
+ */
+function forwardedEntry(header, hops) {
+    if (hops <= 0 || header === undefined)
+        return undefined;
+    const entries = (Array.isArray(header) ? header.join(',') : header).split(',').map((e) => e.trim());
+    return entries[Math.max(0, entries.length - hops)] || undefined;
+}
+/**
+ * The client address: the socket address, or with `trustProxy` (a hop count,
+ * `true` = 1) the `X-Forwarded-For` entry at index `len - hops`.
+ */
+function clientAddress(req, trustProxy) {
+    return forwardedEntry(req.headers['x-forwarded-for'], trustedProxyHops(trustProxy)) ?? req.socket?.remoteAddress ?? 'unknown';
+}
+const DEFAULT_PORTS = { http: '80', https: '443' };
+function firstHeader(value) {
+    const raw = Array.isArray(value) ? value[0] : value;
+    const first = raw?.split(',')[0]?.trim();
+    return first || undefined;
+}
+/** `scheme://host:port`, lower-cased, explicit port (http:80, https:443); `ws`/`wss` map to `http`/`https`. */
+function normalizeOrigin(scheme, hostPort) {
+    let s = scheme.toLowerCase().replace(/:$/, '');
+    if (s === 'ws')
+        s = 'http';
+    if (s === 'wss')
+        s = 'https';
+    if (!DEFAULT_PORTS[s])
+        return undefined;
+    try {
+        const url = new URL(`${s}://${hostPort}`);
+        if (url.username || url.password || (url.pathname && url.pathname !== '/') || url.search || url.hash)
+            return undefined;
+        return `${s}://${url.hostname.toLowerCase()}:${url.port || DEFAULT_PORTS[s]}`;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Trusted proxy hops for the forwarded headers: from `trustProxy`, or — when it
+ * is omitted and the Express app's `trust proxy` setting trusts the socket — that
+ * setting's hop count (a number), otherwise 1.
+ */
+function proxyHops(req, trustProxy) {
+    if (trustProxy !== undefined)
+        return trustedProxyHops(trustProxy);
+    const fn = req.app?.get?.('trust proxy fn');
+    if (typeof fn !== 'function' || !fn(req.socket?.remoteAddress, 0))
+        return 0;
+    const setting = req.app?.get?.('trust proxy');
+    return typeof setting === 'number' ? trustedProxyHops(setting) || 1 : 1;
+}
+/**
+ * The request's own origin (`scheme://host:port`, normalized): the scheme from
+ * the socket (TLS or not) and the `Host` header. Behind a trusted proxy
+ * (`trustProxy`, or the Express app's `trust proxy` setting when omitted)
+ * `X-Forwarded-Proto` / `X-Forwarded-Host` win, read like `X-Forwarded-For`:
+ * the entry at index `len - hops` (the rightmost with one hop; the leftmost
+ * when the list is shorter; an empty entry is ignored).
+ */
+function requestOrigin(req, trustProxy) {
+    const hops = proxyHops(req, trustProxy);
+    const scheme = forwardedEntry(req.headers['x-forwarded-proto'], hops) || (req.socket?.encrypted ? 'https' : 'http');
+    const host = forwardedEntry(req.headers['x-forwarded-host'], hops) || firstHeader(req.headers['host']);
+    return host ? normalizeOrigin(scheme, host) : undefined;
+}
+/**
+ * True when `origin` is the request's own origin (e.g. the bundled admin
+ * dashboard served by this server). Same-origin requests are not cross-site
+ * and always pass Origin/CSRF checks. Case-insensitive; default ports normalized.
+ */
+function isSameOrigin(origin, req, trustProxy) {
+    if (!origin || origin === 'null')
+        return false;
+    let o;
+    try {
+        const url = new URL(origin);
+        o = normalizeOrigin(url.protocol, url.host);
+    }
+    catch {
+        return false;
+    }
+    const own = requestOrigin(req, trustProxy);
+    return !!o && !!own && o === own;
+}
+//# sourceMappingURL=cli-server-auth.js.map

package/dist/src/auth/cli-server-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-server-auth.js","sourceRoot":"","sources":["../../../src/auth/cli-server-auth.ts"],"names":[],"mappings":";;;AAsGA,0CAWC;AAOD,4CAMC;AAmBD,sCAKC;AAsDD,sCAKC;AAOD,oCAWC;AA9ID,6EAA6E;AAChE,QAAA,oBAAoB,GAAG;IAChC,eAAe,EAAE,kBAAkB;IACnC,SAAS,EAAE,YAAY;IACvB,UAAU,EAAE,aAAa;IACzB,SAAS,EAAE,YAAY;IACvB,QAAQ,EAAE,WAAW;IACrB,UAAU,EAAE,aAAa;IACzB,QAAQ,EAAE,WAAW;IACrB,YAAY,EAAE,eAAe;IAC7B,WAAW,EAAE,cAAc;CACrB,CAAC;AAEX;;;GAGG;AACH,SAAgB,eAAe,CAAC,MAA0B,EAAE,OAAsC;IAC9F,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,CAAC,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACnD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;QAC1B,MAAM,CAAC,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACnB,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAC5B,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9F,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC,CAAC,CAAC;AACP,CAAC;AAED;;;;GAIG;AACH,SAAgB,gBAAgB,CAAC,UAAwC;IACrE,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QACjC,IAAI,UAAU,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC;QAC/B,OAAO,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9B,CAAC;AAED;;;;;;GAMG;AACH,SAAS,cAAc,CAAC,MAAqC,EAAE,IAAY;IACvE,IAAI,IAAI,IAAI,CAAC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxD,MAAM,OAAO,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACpG,OAAO,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,IAAI,SAAS,CAAC;AACpE,CAAC;AAED;;;GAGG;AACH,SAAgB,aAAa,CACzB,GAA2G,EAC3G,UAAwC;IAExC,OAAO,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,gBAAgB,CAAC,UAAU,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,EAAE,aAAa,IAAI,SAAS,CAAC;AAClI,CAAC;AAUD,MAAM,aAAa,GAA2B,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAE3E,SAAS,WAAW,CAAC,KAAoC;IACrD,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACpD,MAAM,KAAK,GAAG,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IACzC,OAAO,KAAK,IAAI,SAAS,CAAC;AAC9B,CAAC;AAED,+GAA+G;AAC/G,SAAS,eAAe,CAAC,MAAc,EAAE,QAAgB;IACrD,IAAI,CAAC,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC/C,IAAI,CAAC,KAAK,IAAI;QAAE,CAAC,GAAG,MAAM,CAAC;IAC3B,IAAI,CAAC,KAAK,KAAK;QAAE,CAAC,GAAG,OAAO,CAAC;IAC7B,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,QAAQ,EAAE,CAAC,CAAC;QAC1C,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI;YAAE,OAAO,SAAS,CAAC;QACvH,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,IAAI,GAAG,CAAC,IAAI,IAAI,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;IAClF,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,SAAS,CAAC;IACrB,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAAC,GAAuB,EAAE,UAAwC;IAChF,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAClE,MAAM,EAAE,GAAG,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,gBAAgB,CAAC,CAAC;IAC5C,IAAI,OAAO,EAAE,KAAK,UAAU,IAAI,CAAE,EAAuD,CAAC,GAAG,CAAC,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC;IAClI,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,CAAC;IAC9C,OAAO,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,aAAa,CAAC,GAAuB,EAAE,UAA6B;IAChF,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACpH,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE,IAAI,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IACvG,OAAO,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5D,CAAC;AAED;;;;GAIG;AACH,SAAgB,YAAY,CAAC,MAA0B,EAAE,GAAuB,EAAE,UAA6B;IAC3G,IAAI,CAAC,MAAM,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,CAAqB,CAAC;IAC1B,IAAI,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC,GAAG,eAAe,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAC3C,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC;AACrC,CAAC"}

package/dist/src/auth/index.d.ts

@@ -0,0 +1,4 @@
+export { CliServerAuthContext, CliServerAuthError, CliServerAuditEntry, CliServerSessionEvent, ICliServerAuth, CliServerPermissions, isOriginAllowed, isSameOrigin, requestOrigin, clientAddress, trustedProxyHops, } from './cli-server-auth';
+export { createServerAuthGate, ServerAuthGateOptions, requiredServerPermissions, processorPermissions, normalizePath, } from './cli-server-auth-gate';
+export { authorizeWsUpgrade, rejectUpgrade, WsUpgradeAuthOptions, WsUpgradeAuthResult } from './ws-upgrade-auth';
+//# sourceMappingURL=index.d.ts.map

package/dist/src/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACH,oBAAoB,EACpB,kBAAkB,EAClB,mBAAmB,EACnB,qBAAqB,EACrB,cAAc,EACd,oBAAoB,EACpB,eAAe,EACf,YAAY,EACZ,aAAa,EACb,aAAa,EACb,gBAAgB,GACnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACH,oBAAoB,EACpB,qBAAqB,EACrB,yBAAyB,EACzB,oBAAoB,EACpB,aAAa,GAChB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/src/auth/index.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.rejectUpgrade = exports.authorizeWsUpgrade = exports.normalizePath = exports.processorPermissions = exports.requiredServerPermissions = exports.createServerAuthGate = exports.trustedProxyHops = exports.clientAddress = exports.requestOrigin = exports.isSameOrigin = exports.isOriginAllowed = exports.CliServerPermissions = void 0;
+var cli_server_auth_1 = require("./cli-server-auth");
+Object.defineProperty(exports, "CliServerPermissions", { enumerable: true, get: function () { return cli_server_auth_1.CliServerPermissions; } });
+Object.defineProperty(exports, "isOriginAllowed", { enumerable: true, get: function () { return cli_server_auth_1.isOriginAllowed; } });
+Object.defineProperty(exports, "isSameOrigin", { enumerable: true, get: function () { return cli_server_auth_1.isSameOrigin; } });
+Object.defineProperty(exports, "requestOrigin", { enumerable: true, get: function () { return cli_server_auth_1.requestOrigin; } });
+Object.defineProperty(exports, "clientAddress", { enumerable: true, get: function () { return cli_server_auth_1.clientAddress; } });
+Object.defineProperty(exports, "trustedProxyHops", { enumerable: true, get: function () { return cli_server_auth_1.trustedProxyHops; } });
+var cli_server_auth_gate_1 = require("./cli-server-auth-gate");
+Object.defineProperty(exports, "createServerAuthGate", { enumerable: true, get: function () { return cli_server_auth_gate_1.createServerAuthGate; } });
+Object.defineProperty(exports, "requiredServerPermissions", { enumerable: true, get: function () { return cli_server_auth_gate_1.requiredServerPermissions; } });
+Object.defineProperty(exports, "processorPermissions", { enumerable: true, get: function () { return cli_server_auth_gate_1.processorPermissions; } });
+Object.defineProperty(exports, "normalizePath", { enumerable: true, get: function () { return cli_server_auth_gate_1.normalizePath; } });
+var ws_upgrade_auth_1 = require("./ws-upgrade-auth");
+Object.defineProperty(exports, "authorizeWsUpgrade", { enumerable: true, get: function () { return ws_upgrade_auth_1.authorizeWsUpgrade; } });
+Object.defineProperty(exports, "rejectUpgrade", { enumerable: true, get: function () { return ws_upgrade_auth_1.rejectUpgrade; } });
+//# sourceMappingURL=index.js.map

package/dist/src/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/auth/index.ts"],"names":[],"mappings":";;;AAAA,qDAY2B;AANvB,uHAAA,oBAAoB,OAAA;AACpB,kHAAA,eAAe,OAAA;AACf,+GAAA,YAAY,OAAA;AACZ,gHAAA,aAAa,OAAA;AACb,gHAAA,aAAa,OAAA;AACb,mHAAA,gBAAgB,OAAA;AAEpB,+DAMgC;AAL5B,4HAAA,oBAAoB,OAAA;AAEpB,iIAAA,yBAAyB,OAAA;AACzB,4HAAA,oBAAoB,OAAA;AACpB,qHAAA,aAAa,OAAA;AAEjB,qDAAiH;AAAxG,qHAAA,kBAAkB,OAAA;AAAE,gHAAA,aAAa,OAAA"}

package/dist/src/auth/ws-upgrade-auth.d.ts

@@ -0,0 +1,30 @@
+import type { IncomingMessage } from 'http';
+import type { Duplex } from 'stream';
+import { CliServerAuthContext, ICliServerAuth } from './cli-server-auth';
+export interface WsUpgradeAuthOptions {
+    auth?: ICliServerAuth;
+    allowedOrigins?: string[];
+    /** Honour `X-Forwarded-Proto`/`X-Forwarded-Host` when deciding whether the Origin is the server's own. */
+    trustProxy?: boolean | number;
+    /** Permission required on top of authentication (protected mode only). */
+    permission?: string;
+}
+export type WsUpgradeAuthResult = {
+    ok: true;
+    ctx?: CliServerAuthContext;
+} | {
+    ok: false;
+    status: 401 | 403;
+};
+/**
+ * Authorizes a WebSocket upgrade:
+ * - when `allowedOrigins` is set, a present `Origin` header must be allowed or
+ *   be the server's own origin (same-origin, e.g. the bundled dashboard) (403);
+ * - with a protecting auth provider, a valid single-use `?ticket=` is required
+ *   (401) and the optional permission is checked (403);
+ * - otherwise a ticket, when present, only attaches an identity.
+ */
+export declare function authorizeWsUpgrade(request: IncomingMessage, url: URL, options: WsUpgradeAuthOptions): Promise<WsUpgradeAuthResult>;
+/** Rejects an upgrade with a bare HTTP status response. */
+export declare function rejectUpgrade(socket: Duplex, status: number): void;
+//# sourceMappingURL=ws-upgrade-auth.d.ts.map

package/dist/src/auth/ws-upgrade-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ws-upgrade-auth.d.ts","sourceRoot":"","sources":["../../../src/auth/ws-upgrade-auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,MAAM,CAAC;AAC5C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAiC,MAAM,mBAAmB,CAAC;AAExG,MAAM,WAAW,oBAAoB;IACjC,IAAI,CAAC,EAAE,cAAc,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,0GAA0G;IAC1G,UAAU,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IAC9B,0EAA0E;IAC1E,UAAU,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,MAAM,mBAAmB,GACzB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,GAAG,CAAC,EAAE,oBAAoB,CAAA;CAAE,GACxC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,GAAG,GAAG,GAAG,CAAA;CAAE,CAAC;AAEvC;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACpC,OAAO,EAAE,eAAe,EACxB,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,oBAAoB,GAC9B,OAAO,CAAC,mBAAmB,CAAC,CAyB9B;AAED,2DAA2D;AAC3D,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAQlE"}

package/dist/src/auth/ws-upgrade-auth.js

@@ -0,0 +1,49 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.authorizeWsUpgrade = authorizeWsUpgrade;
+exports.rejectUpgrade = rejectUpgrade;
+const cli_server_auth_1 = require("./cli-server-auth");
+/**
+ * Authorizes a WebSocket upgrade:
+ * - when `allowedOrigins` is set, a present `Origin` header must be allowed or
+ *   be the server's own origin (same-origin, e.g. the bundled dashboard) (403);
+ * - with a protecting auth provider, a valid single-use `?ticket=` is required
+ *   (401) and the optional permission is checked (403);
+ * - otherwise a ticket, when present, only attaches an identity.
+ */
+async function authorizeWsUpgrade(request, url, options) {
+    const origin = request.headers.origin;
+    if (options.allowedOrigins && options.allowedOrigins.length > 0 && origin !== undefined) {
+        if (!(0, cli_server_auth_1.isOriginAllowed)(origin, options.allowedOrigins) && !(0, cli_server_auth_1.isSameOrigin)(origin, request, options.trustProxy ?? false)) {
+            return { ok: false, status: 403 };
+        }
+    }
+    const auth = options.auth;
+    if (!auth) {
+        return { ok: true };
+    }
+    const ticket = url.searchParams.get('ticket');
+    const ctx = ticket ? await auth.consumeTicket(ticket).catch(() => undefined) : undefined;
+    if (!auth.protectServer) {
+        return { ok: true, ctx };
+    }
+    if (!ctx) {
+        return { ok: false, status: 401 };
+    }
+    if (options.permission && !auth.hasPermission(ctx, options.permission)) {
+        return { ok: false, status: 403 };
+    }
+    return { ok: true, ctx };
+}
+/** Rejects an upgrade with a bare HTTP status response. */
+function rejectUpgrade(socket, status) {
+    const text = status === 401 ? 'Unauthorized' : status === 403 ? 'Forbidden' : status === 404 ? 'Not Found' : 'Error';
+    try {
+        socket.write(`HTTP/1.1 ${status} ${text}\r\nConnection: close\r\nContent-Length: 0\r\n\r\n`);
+    }
+    catch {
+        // ignore
+    }
+    socket.destroy();
+}
+//# sourceMappingURL=ws-upgrade-auth.js.map

package/dist/src/auth/ws-upgrade-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ws-upgrade-auth.js","sourceRoot":"","sources":["../../../src/auth/ws-upgrade-auth.ts"],"names":[],"mappings":";;AAyBA,gDA6BC;AAGD,sCAQC;AA/DD,uDAAwG;AAexG;;;;;;;GAOG;AACI,KAAK,UAAU,kBAAkB,CACpC,OAAwB,EACxB,GAAQ,EACR,OAA6B;IAE7B,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;IACtC,IAAI,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACtF,IAAI,CAAC,IAAA,iCAAe,EAAC,MAAM,EAAE,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,IAAA,8BAAY,EAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,UAAU,IAAI,KAAK,CAAC,EAAE,CAAC;YAClH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;QACtC,CAAC;IACL,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAC1B,IAAI,CAAC,IAAI,EAAE,CAAC;QACR,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACxB,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAEzF,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;QACtB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;IAC7B,CAAC;IACD,IAAI,CAAC,GAAG,EAAE,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IACtC,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACrE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IACtC,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AAC7B,CAAC;AAED,2DAA2D;AAC3D,SAAgB,aAAa,CAAC,MAAc,EAAE,MAAc;IACxD,MAAM,IAAI,GAAG,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC;IACrH,IAAI,CAAC;QACD,MAAM,CAAC,KAAK,CAAC,YAAY,MAAM,IAAI,IAAI,oDAAoD,CAAC,CAAC;IACjG,CAAC;IAAC,MAAM,CAAC;QACL,SAAS;IACb,CAAC;IACD,MAAM,CAAC,OAAO,EAAE,CAAC;AACrB,CAAC"}

package/dist/src/controllers/cli-controller.d.ts

@@ -1,4 +1,11 @@
 import { Router } from 'express';
 import { ICliCommandRegistry, ICliCommandExecutorService } from '../services';
-export declare function createCliController(registry: ICliCommandRegistry, executor: ICliCommandExecutorService): Router;
+import { CapabilitiesOptions } from './cli-version-controller';
+/**
+ * Creates an Express router for the v1 CLI API with version, capabilities, commands, and execute endpoints.
+ * @param registry - Command registry to list available processors.
+ * @param executor - Service that dispatches commands to processors.
+ * @returns Configured Express router.
+ */
+export declare function createCliController(registry: ICliCommandRegistry, executor: ICliCommandExecutorService, options?: CapabilitiesOptions): Router;
 //# sourceMappingURL=cli-controller.d.ts.map

package/dist/src/controllers/cli-controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-controller.d.ts","sourceRoot":"","sources":["../../../src/controllers/cli-controller.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAIjC,OAAO,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,MAAM,aAAa,CAAC;AAI9E,wBAAgB,mBAAmB,CAC/B,QAAQ,EAAE,mBAAmB,EAC7B,QAAQ,EAAE,0BAA0B,GACrC,MAAM,CAuCR"}
+{"version":3,"file":"cli-controller.d.ts","sourceRoot":"","sources":["../../../src/controllers/cli-controller.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAIjC,OAAO,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,MAAM,aAAa,CAAC;AAE9E,OAAO,EAAE,mBAAmB,EAA4B,MAAM,0BAA0B,CAAC;AAKzF;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAC/B,QAAQ,EAAE,mBAAmB,EAC7B,QAAQ,EAAE,0BAA0B,EACpC,OAAO,CAAC,EAAE,mBAAmB,GAC9B,MAAM,CAmHR"}

package/dist/src/controllers/cli-controller.js

@@ -36,8 +36,18 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.createCliController = createCliController;
 const express_1 = require("express");
 const os = __importStar(require("os"));
+const abstractions_1 = require("../abstractions");
+const logger_1 = require("../utils/logger");
+const cli_version_controller_1 = require("./cli-version-controller");
+const logger = (0, logger_1.createLogger)('CliController');
 const SERVER_VERSION = '1.0.0';
-function createCliController(registry, executor) {
+/**
+ * Creates an Express router for the v1 CLI API with version, capabilities, commands, and execute endpoints.
+ * @param registry - Command registry to list available processors.
+ * @param executor - Service that dispatches commands to processors.
+ * @returns Configured Express router.
+ */
+function createCliController(registry, executor, options) {
     const router = (0, express_1.Router)();
     router.get('/version', (_req, res) => {
         res.json({ version: SERVER_VERSION });
@@ -53,10 +63,11 @@ function createCliController(registry, executor) {
             ? 'C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe'
             : '/bin/bash';
         res.json({
-            shell: true,
+            ...(0, cli_version_controller_1.resolveShellCapabilities)(options),
             os: detectedOs,
             shellPath,
             version: SERVER_VERSION,
+            streaming: true,
         });
     });
     router.get('/commands', (_req, res) => {
@@ -65,11 +76,75 @@ function createCliController(registry, executor) {
     });
     router.post('/execute', async (req, res) => {
         const command = req.body;
-        const response = await executor.executeAsync(command);
+        if (typeof command?.command !== 'string') {
+            res.status(400).json({ error: 'command is required' });
+            return;
+        }
+        logger.debug('Executing command: %s', command.command);
+        const abortController = new AbortController();
+        req.on('close', () => abortController.abort());
+        const response = await executor.executeAsync(command, abortController.signal);
         res.json(response);
     });
+    router.post('/execute/stream', async (req, res) => {
+        const command = req.body;
+        logger.debug('Stream executing command: %s', command.command);
+        const abortController = new AbortController();
+        req.on('close', () => abortController.abort());
+        const signal = abortController.signal;
+        // SSE headers
+        res.setHeader('Content-Type', 'text/event-stream');
+        res.setHeader('Cache-Control', 'no-cache');
+        res.setHeader('Connection', 'keep-alive');
+        res.setHeader('X-Accel-Buffering', 'no');
+        res.flushHeaders();
+        const emit = (output) => {
+            res.write(`event: output\ndata: ${JSON.stringify(output)}\n\n`);
+        };
+        try {
+            const processor = registry.findProcessor(command.command, command.chainCommands?.length ? command.chainCommands : undefined);
+            if (!processor) {
+                res.write(`event: error\ndata: ${JSON.stringify({ message: `Unknown command: ${command.command}` })}\n\n`);
+                res.end();
+                return;
+            }
+            if (executor.isBlocked(processor)) {
+                res.write(`event: error\ndata: ${JSON.stringify({ message: `Command '${command.command}' is currently disabled.` })}\n\n`);
+                res.end();
+                return;
+            }
+            let exitCode;
+            if ((0, abstractions_1.isStreamCapable)(processor)) {
+                exitCode = await processor.handleStreamAsync(command, emit, signal);
+            }
+            else if (processor.handleStructuredAsync) {
+                const response = await processor.handleStructuredAsync(command, signal);
+                for (const output of response.outputs) {
+                    emit(output);
+                }
+                exitCode = response.exitCode;
+            }
+            else {
+                const result = await processor.handleAsync(command, signal);
+                emit({ type: 'text', value: result });
+                exitCode = 0;
+            }
+            res.write(`event: done\ndata: ${JSON.stringify({ exitCode })}\n\n`);
+        }
+        catch (err) {
+            if (signal.aborted) {
+                logger.debug('Stream cancelled for command: %s', command.command);
+            }
+            else {
+                logger.error('Stream execution failed: %s - %s', command.command, err.message ?? err);
+                res.write(`event: error\ndata: ${JSON.stringify({ message: `Error executing command: ${err.message ?? err}` })}\n\n`);
+            }
+        }
+        res.end();
+    });
     return router;
 }
+/** Maps an {@link ICliCommandProcessor} to its serializable DTO representation. */
 function mapToDescriptor(processor) {
     const descriptor = {
         command: processor.command,

package/dist/src/controllers/cli-controller.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli-controller.js","sourceRoot":"","sources":["../../../src/controllers/cli-controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAQA,kDA0CC;AAlDD,qCAAiC;AACjC,uCAAyB;AAKzB,MAAM,cAAc,GAAG,OAAO,CAAC;AAE/B,SAAgB,mBAAmB,CAC/B,QAA6B,EAC7B,QAAoC;IAEpC,MAAM,MAAM,GAAG,IAAA,gBAAM,GAAE,CAAC;IAExB,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACjC,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACtC,MAAM,UAAU,GAAG,EAAE,CAAC,QAAQ,EAAE,KAAK,OAAO;YACxC,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,EAAE,CAAC,QAAQ,EAAE,KAAK,QAAQ;gBACxB,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,OAAO,CAAC;QAElB,MAAM,KAAK,GAAG,EAAE,CAAC,QAAQ,EAAE,KAAK,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC;QAChE,MAAM,SAAS,GAAG,EAAE,CAAC,QAAQ,EAAE,KAAK,OAAO;YACvC,CAAC,CAAC,gEAAgE;YAClE,CAAC,CAAC,WAAW,CAAC;QAElB,GAAG,CAAC,IAAI,CAAC;YACL,KAAK,EAAE,IAAI;YACX,EAAE,EAAE,UAAU;YACd,SAAS;YACT,OAAO,EAAE,cAAc;SAC1B,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAClC,MAAM,WAAW,GAAG,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC7D,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACvC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC;QACzB,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QACtD,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,SAAS,eAAe,CAAC,SAA+B;IACpD,MAAM,UAAU,GAA+B;QAC3C,OAAO,EAAE,SAAS,CAAC,OAAO;QAC1B,WAAW,EAAE,SAAS,CAAC,WAAW;QAClC,OAAO,EAAE,SAAS,CAAC,OAAO;KAC7B,CAAC;IAEF,IAAI,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QAC/B,UAAU,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,GAAG,CAC5C,CAAC,CAAC,EAA0C,EAAE,CAAC,CAAC;YAC5C,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,YAAY,EAAE,CAAC,CAAC,YAAY;SAC/B,CAAC,CACL,CAAC;IACN,CAAC;IAED,IAAI,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QAC/B,UAAU,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACtE,CAAC;IAED,OAAO,UAAU,CAAC;AACtB,CAAC"}
+{"version":3,"file":"cli-controller.js","sourceRoot":"","sources":["../../../src/controllers/cli-controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiBA,kDAuHC;AAxID,qCAAiC;AACjC,uCAAyB;AACzB,kDAA6F;AAG7F,4CAA+C;AAC/C,qEAAyF;AAEzF,MAAM,MAAM,GAAG,IAAA,qBAAY,EAAC,eAAe,CAAC,CAAC;AAC7C,MAAM,cAAc,GAAG,OAAO,CAAC;AAE/B;;;;;GAKG;AACH,SAAgB,mBAAmB,CAC/B,QAA6B,EAC7B,QAAoC,EACpC,OAA6B;IAE7B,MAAM,MAAM,GAAG,IAAA,gBAAM,GAAE,CAAC;IAExB,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACjC,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACtC,MAAM,UAAU,GAAG,EAAE,CAAC,QAAQ,EAAE,KAAK,OAAO;YACxC,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,EAAE,CAAC,QAAQ,EAAE,KAAK,QAAQ;gBACxB,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,OAAO,CAAC;QAElB,MAAM,KAAK,GAAG,EAAE,CAAC,QAAQ,EAAE,KAAK,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC;QAChE,MAAM,SAAS,GAAG,EAAE,CAAC,QAAQ,EAAE,KAAK,OAAO;YACvC,CAAC,CAAC,gEAAgE;YAClE,CAAC,CAAC,WAAW,CAAC;QAElB,GAAG,CAAC,IAAI,CAAC;YACL,GAAG,IAAA,iDAAwB,EAAC,OAAO,CAAC;YACpC,EAAE,EAAE,UAAU;YACd,SAAS;YACT,OAAO,EAAE,cAAc;YACvB,SAAS,EAAE,IAAI;SAClB,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAClC,MAAM,WAAW,GAAG,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC7D,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACvC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC;QACzB,IAAI,OAAO,OAAO,EAAE,OAAO,KAAK,QAAQ,EAAE,CAAC;YACvC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC;YACvD,OAAO;QACX,CAAC;QACD,MAAM,CAAC,KAAK,CAAC,uBAAuB,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QAEvD,MAAM,eAAe,GAAG,IAAI,eAAe,EAAE,CAAC;QAC9C,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC,CAAC;QAE/C,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,OAAO,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC;QAC9E,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC9C,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC;QACzB,MAAM,CAAC,KAAK,CAAC,8BAA8B,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QAE9D,MAAM,eAAe,GAAG,IAAI,eAAe,EAAE,CAAC;QAC9C,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC;QAEtC,cAAc;QACd,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,mBAAmB,CAAC,CAAC;QACnD,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAC3C,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;QAC1C,GAAG,CAAC,SAAS,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAC;QACzC,GAAG,CAAC,YAAY,EAAE,CAAC;QAEnB,MAAM,IAAI,GAAG,CAAC,MAA2B,EAAE,EAAE;YACzC,GAAG,CAAC,KAAK,CAAC,wBAAwB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACpE,CAAC,CAAC;QAEF,IAAI,CAAC;YACD,MAAM,SAAS,GAAG,QAAQ,CAAC,aAAa,CACpC,OAAO,CAAC,OAAO,EACf,OAAO,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CACpE,CAAC;YAEF,IAAI,CAAC,SAAS,EAAE,CAAC;gBACb,GAAG,CAAC,KAAK,CAAC,uBAAuB,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,oBAAoB,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;gBAC3G,GAAG,CAAC,GAAG,EAAE,CAAC;gBACV,OAAO;YACX,CAAC;YAED,IAAI,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;gBAChC,GAAG,CAAC,KAAK,CAAC,uBAAuB,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,YAAY,OAAO,CAAC,OAAO,0BAA0B,EAAE,CAAC,MAAM,CAAC,CAAC;gBAC3H,GAAG,CAAC,GAAG,EAAE,CAAC;gBACV,OAAO;YACX,CAAC;YAED,IAAI,QAAgB,CAAC;YAErB,IAAI,IAAA,8BAAe,EAAC,SAAS,CAAC,EAAE,CAAC;gBAC7B,QAAQ,GAAG,MAAM,SAAS,CAAC,iBAAiB,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;YACxE,CAAC;iBAAM,IAAI,SAAS,CAAC,qBAAqB,EAAE,CAAC;gBACzC,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,qBAAqB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBACxE,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;oBACpC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACjB,CAAC;gBACD,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC;YACjC,CAAC;iBAAM,CAAC;gBACJ,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBAC5D,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;gBACtC,QAAQ,GAAG,CAAC,CAAC;YACjB,CAAC;YAED,GAAG,CAAC,KAAK,CAAC,sBAAsB,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAC,MAAM,CAAC,CAAC;QACxE,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAChB,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACjB,MAAM,CAAC,KAAK,CAAC,kCAAkC,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;YACtE,CAAC;iBAAM,CAAC;gBACJ,MAAM,CAAC,KAAK,CAAC,kCAAkC,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,CAAC;gBACtF,GAAG,CAAC,KAAK,CAAC,uBAAuB,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,4BAA4B,GAAG,CAAC,OAAO,IAAI,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;YAC1H,CAAC;QACL,CAAC;QAED,GAAG,CAAC,GAAG,EAAE,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,mFAAmF;AACnF,SAAS,eAAe,CAAC,SAA+B;IACpD,MAAM,UAAU,GAA+B;QAC3C,OAAO,EAAE,SAAS,CAAC,OAAO;QAC1B,WAAW,EAAE,SAAS,CAAC,WAAW;QAClC,OAAO,EAAE,SAAS,CAAC,OAAO;KAC7B,CAAC;IAEF,IAAI,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QAC/B,UAAU,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,GAAG,CAC5C,CAAC,CAAC,EAA0C,EAAE,CAAC,CAAC;YAC5C,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,YAAY,EAAE,CAAC,CAAC,YAAY;SAC/B,CAAC,CACL,CAAC;IACN,CAAC;IAED,IAAI,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QAC/B,UAAU,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACtE,CAAC;IAED,OAAO,UAAU,CAAC;AACtB,CAAC"}

package/dist/src/controllers/cli-version-controller.d.ts

@@ -1,3 +1,18 @@
 import { Router } from 'express';
-export declare function createCliVersionController(): Router;
+/** Shell part of `/capabilities`: `shellAuth` only when the shell is enabled. */
+export interface ShellCapabilities {
+    shell: boolean;
+    shellAuth?: 'users' | 'token' | 'custom' | 'anonymous' | 'locked';
+}
+export interface CapabilitiesOptions {
+    /** Live shell state; when omitted `/capabilities` reports `shell: true` (legacy). */
+    shellCapabilities?: () => ShellCapabilities;
+}
+/** Resolves the shell fields of `/capabilities`. */
+export declare function resolveShellCapabilities(options?: CapabilitiesOptions): ShellCapabilities;
+/**
+ * Creates an Express router for API version discovery and server capabilities.
+ * @returns Router with `/versions` and `/capabilities` endpoints.
+ */
+export declare function createCliVersionController(options?: CapabilitiesOptions): Router;
 //# sourceMappingURL=cli-version-controller.d.ts.map

package/dist/src/controllers/cli-version-controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-version-controller.d.ts","sourceRoot":"","sources":["../../../src/controllers/cli-version-controller.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAMjC,wBAAgB,0BAA0B,IAAI,MAAM,CAgCnD"}
+{"version":3,"file":"cli-version-controller.d.ts","sourceRoot":"","sources":["../../../src/controllers/cli-version-controller.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAMjC,iFAAiF;AACjF,MAAM,WAAW,iBAAiB;IAC9B,KAAK,EAAE,OAAO,CAAC;IACf,SAAS,CAAC,EAAE,OAAO,GAAG,OAAO,GAAG,QAAQ,GAAG,WAAW,GAAG,QAAQ,CAAC;CACrE;AAED,MAAM,WAAW,mBAAmB;IAChC,qFAAqF;IACrF,iBAAiB,CAAC,EAAE,MAAM,iBAAiB,CAAC;CAC/C;AAED,oDAAoD;AACpD,wBAAgB,wBAAwB,CAAC,OAAO,CAAC,EAAE,mBAAmB,GAAG,iBAAiB,CAEzF;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,CAAC,EAAE,mBAAmB,GAAG,MAAM,CAqChF"}